/
← Voltar ao feed
high telecommunications consumer

Broadcom WPS Flaw Lets Nearby Attackers Gain Root RCE on Wi-Fi Routers Without Password; Belgian ISP Devices Unpatched

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 09:06 · coletado há 1 dia

Researcher Quentin Kaiser (QTNKSR) disclosed a memory corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It allows an unauthenticated attacker within wireless range to disclose memory and execute code, including as root, on vulnerable routers. The attacker does not need the Wi-Fi password, network membership or a completed WPS setup. The flaw has reportedly existed in Broadcom's SDK since at least 2010, and a 2018 patch was incomplete. As of 15 October 2026, the tested ISP-supplied devices were reported as still unpatched. Broadcom assigned no CVE, and no in-the-wild exploitation is reported.

Technical Details

  • Broadcom's software mishandles reassembly of fragmented WPS messages sent over the air, leading to memory corruption. Crafted messages enable memory disclosure and remote code execution. The attack does not depend on the router's web admin interface and can reportedly work over distance.
  • Demonstrations: the Wi-Fi network key was retrieved from an Orange Belgium ASKEY TCG3000 gateway, and a reverse shell was obtained from a Proximus gateway using Wi-Fi frames.
  • Confirmed on chips BCM3380, BCM3383 and BCM33834 (eCos). Potential impact on Linux-based platforms using BCM3390, BCM65xx and BCM68xx.
  • Tested equipment: Proximus BBOX 3 and BBOX3V+, several VOO-supplied Netgear and Technicolor models, and Orange Belgium ASKEY TCG3000. A complete list of affected vendors is not available.
  • Broadcom was informed in 2018, and Kaiser reported the new findings in July 2026. He also contacted affected providers and Belgium's Cyber Security Center.

Remediation

  • No CVE or complete patch exists. Broadcom reportedly advised moving to hostapd. Linux-based products may be fixable if manufacturers integrate the change, while eCos devices face a harder outlook.
  • Check ISP and vendor security notices for the exact model, and ask about firmware updates or replacement.
  • If a model is confirmed affected with no fix, replace it with a supported device. A strong admin password does not mitigate this issue.

Linha do tempo

  1. gbhackers.com ↗ · pub. 19/10/2026 09:06 · coletado 19/10 17:54 primeiro registro

    Broadcom WPS Flaw Lets Nearby Attackers Gain Root RCE on Wi-Fi Routers Without Password; Belgian ISP Devices Unpatched

    ler a análise desta fonte

    Researcher Quentin Kaiser (QTNKSR) disclosed a memory corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It allows an unauthenticated attacker within wireless range to disclose memory and execute code, including as root, on vulnerable routers. The attacker does not need the Wi-Fi password, network membership or a completed WPS setup. The flaw has reportedly existed in Broadcom's SDK since at least 2010, and a 2018 patch was incomplete. As of 15 October 2026, the tested ISP-supplied devices were reported as still unpatched. Broadcom assigned no CVE, and no in-the-wild exploitation is reported.

    Technical Details

    • Broadcom's software mishandles reassembly of fragmented WPS messages sent over the air, leading to memory corruption. Crafted messages enable memory disclosure and remote code execution. The attack does not depend on the router's web admin interface and can reportedly work over distance.
    • Demonstrations: the Wi-Fi network key was retrieved from an Orange Belgium ASKEY TCG3000 gateway, and a reverse shell was obtained from a Proximus gateway using Wi-Fi frames.
    • Confirmed on chips BCM3380, BCM3383 and BCM33834 (eCos). Potential impact on Linux-based platforms using BCM3390, BCM65xx and BCM68xx.
    • Tested equipment: Proximus BBOX 3 and BBOX3V+, several VOO-supplied Netgear and Technicolor models, and Orange Belgium ASKEY TCG3000. A complete list of affected vendors is not available.
    • Broadcom was informed in 2018, and Kaiser reported the new findings in July 2026. He also contacted affected providers and Belgium's Cyber Security Center.

    Remediation

    • No CVE or complete patch exists. Broadcom reportedly advised moving to hostapd. Linux-based products may be fixable if manufacturers integrate the change, while eCos devices face a harder outlook.
    • Check ISP and vendor security notices for the exact model, and ask about firmware updates or replacement.
    • If a model is confirmed affected with no fix, replace it with a supported device. A strong admin password does not mitigate this issue.